Personal Data Processing Policy
Individual Entrepreneur Stanislav Leonidovich Natapov
Moscow
Version dated October 5, 2026
1. General provisions
1.1. This Personal Data Processing Policy (the “Policy”) sets out the purposes, procedure, and conditions for processing personal data, as well as the measures taken to protect such data. It has been prepared to comply with Part 2 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (the “Personal Data Law”).
1.2. The personal data operator is Individual Entrepreneur Stanislav Leonidovich Natapov (the “Operator”), who conducts business under the project name Grand Mission.
1.3. This Policy applies to all personal data the Operator receives from individuals through grand-mission.com (the “Website”), in connection with entering into and performing agreements, and when interacting with counterparties, engaged specialists, and candidates.
1.4. The current version of this Policy is publicly available at grand-mission.com/privacy (in English) and grand-mission.com/privacy_ru (in Russian). In case of any discrepancy between the versions, the Russian text shall prevail.
1.5. Terms used in this Policy have the meanings assigned to them in Article 3 of the Personal Data Law.
2. Operator information
| Full legal name | Individual Entrepreneur Stanislav Leonidovich Natapov |
| Primary state registration number (OGRNIP) | 316774600292443 |
| Taxpayer identification number (INN) | 771470510654 |
| Address | 24 Leninskiy Prospekt, apt. 8, Moscow, Russia |
| Email for personal data inquiries | sn@business-mission.org |
| Person responsible for organizing personal data processing | Stanislav Leonidovich Natapov |
3. Categories of personal data subjects
3.1. The Operator processes the personal data of the following categories of individuals:
— Website visitors who submit an application or other inquiry;
— the Operator’s clients and participants in its programs, communities, and events;
— parents and other legal representatives of program participants who are minors;
— program participants who are minors, based on the consent of their legal representatives;
— representatives of the Operator’s counterparties and partners;
— specialists engaged by the Operator to provide services, and candidates for such engagement.
4. Personal data processed
4.1. When forms are completed on the Website, the Operator processes: the applicant’s last name, first name, and patronymic; contact details (telephone number, email address, messenger identifier); the name and age of the program participant; information on the anticipated budget; the content of the inquiry and any other information voluntarily provided in the form.
4.2. When the Website is used, the following data are automatically recorded in server logs: IP address, browser and device information, and the date and time of access. These data are used solely to maintain the functionality and security of the Website.
4.3. The Website uses only technically necessary cookies that support the operation of forms and retain the selected interface language. The Website does not use web analytics systems, advertising pixels, or other tools that track user behavior.
4.4. In the course of further interaction with the Operator (consultations, diagnostics, participation in programs, communities, and events, entering into and performing agreements), the following are processed: last name, first name, patronymic; date of birth; contact details (phone numbers, email addresses, messenger and social media identifiers); information on education, place of study and occupation; information on professional activity and business voluntarily provided to the Operator; information on requests, interests, goals and available resources; results of psychological testing and diagnostics, assessments of personal characteristics, motivation and skills; profile card content; information on interaction with the Operator (participation in consultations, programs and events, meeting attendance, completion of assignments, history of targeted introductions and arrangements); content of requests and correspondence; audio and video recordings of meetings and events, image and voice; payment and banking details, information on payments made; other information voluntarily provided to the Operator.
4.5. The Operator does not process biometric personal data. Audio and video recordings of meetings, image and voice are not used to establish the identity of a personal data subject.
4.6. Special categories of personal data concerning health are processed solely on the basis of a separate consent of the personal data subject (or his or her legal representative) executed in writing in accordance with Articles 9 and 10 of the Personal Data Law. Special categories of personal data are not collected through the forms on the Website.
4.7. The Operator does not process personal data concerning race or ethnicity, political opinions, religious or philosophical beliefs, or criminal convictions.
5. Purposes and legal bases for processing personal data
5.1. The Operator processes personal data for the following purposes:
| Purpose | Data | Legal basis |
|---|---|---|
| Reviewing an application or inquiry, contacting the applicant, initial consultation, and agreeing on service terms | Clause 4.1 | Consent of the personal data subject — Point 1, Part 1, Article 6 of the Personal Data Law |
| Interaction with the individual in the course of diagnostics, development programs, communities, events and other services of the Operator; preparation of recommendations and development strategies; organization of consultations, curator, mentor and group meetings, and internships; targeted introductions and personal support | Clauses 4.1 and 4.4 | Consent of the personal data subject — Point 1, Part 1, Article 6; performance of an agreement — Point 5, Part 1, Article 6; consent of the legal representative for a minor’s data |
| Entering into, performing, amending and terminating agreements; settlements and accounting documents | Clause 4.4 | Performance of an agreement — Point 5, Part 1, Article 6; compliance with a legal obligation — Point 2, Part 1, Article 6 |
| Taking health information into account for the safe and proper provision of services | Clause 4.6 | Written consent — Point 1, Part 2, Article 10 of the Personal Data Law |
| Sending informational and promotional messages about the Operator’s programs | Name, telephone number, email address, messenger identifier | Separate consent of the personal data subject — Point 1, Part 1, Article 6 of the Personal Data Law and Part 1, Article 18 of the Federal Law “On Advertising” |
| Internal record-keeping, control and improvement of service quality; handling of requests; protection of the Operator’s rights and legitimate interests | Clauses 4.1 and 4.4 | Consent of the personal data subject — Point 1, Part 1, Article 6; exercise of the Operator’s rights and legitimate interests — Point 7, Part 1, Article 6 |
| Maintaining Website functionality and security | Clauses 4.2 and 4.3 | Exercise of the Operator’s rights and legitimate interests — Point 7, Part 1, Article 6 of the Personal Data Law |
| Reviewing cooperation proposals and engaging specialists | Last name, first name, patronymic, contact details, qualifications, and experience | Consent of the personal data subject — Point 1, Part 1, Article 6 of the Personal Data Law |
5.2. The Operator does not process personal data for purposes incompatible with those specified in Clause 5.1 and does not process data in an amount excessive in relation to the stated purposes.
5.3. Personal data, photo and video materials, and image are not used for advertising, marketing or other public purposes without a separate prior written consent of the personal data subject.
6. Procedure and conditions for processing personal data
6.1. Personal data are processed by automated means, without such means, or by a combination thereof.
6.2. Processing includes the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, and destruction of personal data.
6.3. When personal data of citizens of the Russian Federation are collected, their recording, systematization, accumulation, storage, clarification, and extraction are carried out using databases located in the Russian Federation, in accordance with Part 5 of Article 18 of the Personal Data Law.
6.4. To the extent necessary for the purposes set out in Section 5, the Operator may delegate processing and transfer personal data: to employees, subcontractors and specialists engaged by the Operator who are directly involved in the provision of services, subject to their acceptance of confidentiality obligations; to operators of information services and infrastructure used by the Operator (the Website builder and hosting provider, customer relationship and task management systems, knowledge bases and internal portals, email and cloud services, video conferencing platforms, messengers, meeting recording and transcription services, analytics and automated data processing services, psychological testing platforms); to persons providing accounting, tax and legal services to the Operator; to credit institutions and payment service operators; to state authorities in the cases and to the extent provided for by the legislation of the Russian Federation. When delegating processing to a third party, the Operator remains responsible for the processing of the transferred data.
6.5. On the basis of the personal data subject’s consent, the Operator carries out automated processing of personal data using artificial intelligence technologies: recording, transcription and summarization of audio and video recordings of meetings, automated analysis of the content of meetings and correspondence, and preparation of the Operator’s analytical and working materials on their basis. No decisions producing legal consequences for a personal data subject or otherwise affecting his or her rights and legitimate interests are made solely on the basis of automated processing of personal data.
6.6. On the basis of the personal data subject’s consent, members of the Business Mission Community may be provided with the data of other members (last name, first name, patronymic; profile photo; profile card content; contact details to the extent agreed for a specific introduction) for the purposes of targeted introductions and organization of member interaction. Such provision does not constitute dissemination of personal data to an unlimited group of persons.
6.7. The Operator does not sell personal data, does not transfer such data to third parties for their own purposes, and does not publish them in publicly available sources.
6.8. Access to personal data is granted only to persons who need it to perform their duties.
7. Processing and retention periods
7.1. Personal data are processed for the following periods:
| Category of personal data | Processing period |
|---|---|
| Data processed on the basis of the personal data subject’s consent (applications, inquiries, interaction with the Operator) | The period of interaction with the Operator and 10 years after its completion: if an agreement has been concluded — from the date of its performance or termination; if no agreement has been concluded — from the date of the individual’s last interaction with the Operator |
| Health information | The term of the agreement and 10 years after its performance or termination |
| Data contained in mandatory accounting documents | For the periods established by the legislation of the Russian Federation |
| Data processed for sending informational and promotional messages | Until the relevant consent is withdrawn |
| Server logs and technically necessary cookies | No more than 12 months |
7.2. Upon expiry of the processing period, or if consent is withdrawn, personal data are destroyed or anonymized within 30 days, except for data processed on other legal grounds (performance of an agreement, legal requirements, protection of the Operator’s rights and legitimate interests).
8. Personal data of minors
8.1. Forms on the Website are intended to be completed by adults. The Operator does not purposefully collect the personal data of minors through the Website.
8.2. Personal data of a program participant under the age of 18 are processed on the basis of a separate consent of his or her parent or other legal representative.
8.3. If the Operator becomes aware that a minor’s personal data have been obtained without the consent of his or her legal representative, processing of such data is discontinued and the data are destroyed within 30 days.
9. Cross-border transfer of personal data
9.1. When the information services specified in Clause 6.4 are used and their infrastructure is located outside the Russian Federation, personal data may be transferred to the territory of foreign states. Such transfers are carried out in compliance with Article 12 of the Personal Data Law.
10. Personal data security measures
10.1. The Operator takes the legal, organizational, and technical measures provided for in Articles 18.1 and 19 of the Personal Data Law, including:
— appointing a person responsible for organizing personal data processing;
— issuing documents that define the Operator’s policy on personal data processing;
— limiting the group of persons with access to personal data and binding them with confidentiality obligations;
— using a secure connection (HTTPS) when data are transmitted through the Website;
— storing health information with restricted access;
— internal control of compliance of processing with legal requirements.
10.2. The Operator notifies the authorized body for the protection of the rights of personal data subjects of incidents that have resulted in a violation of the rights of personal data subjects, within the time limits established by Part 3.1 of Article 21 of the Personal Data Law.
11. Rights of the personal data subject
11.1. A personal data subject has the right to:
— obtain information concerning the processing of his or her personal data to the extent provided for in Part 7 of Article 14 of the Personal Data Law;
— request clarification of his or her personal data, or their blocking or destruction, if the data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
— withdraw consent to the processing of personal data;
— object to the processing of his or her personal data for the purpose of promoting services on the market;
— appeal against the Operator’s actions or inaction to the authorized body for the protection of the rights of personal data subjects or in court.
11.2. Requests are sent to sn@business-mission.org or by post to the address specified in Section 2 of this Policy. A request must contain information that makes it possible to identify the individual and confirms that the Operator processes his or her personal data.
11.3. The Operator reviews a request and responds within 10 business days of receiving it. This period may be extended by no more than 5 business days, with a reasoned notice of the reasons for the extension sent to the individual.
11.4. Consent to the processing of personal data is withdrawn by sending a written notice to the Operator as specified in Clause 11.2. Withdrawal does not affect the lawfulness of processing carried out before its receipt. Withdrawal of consent before completion of the services may make their further provision impossible.
12. Final provisions
12.1. The Operator may amend this Policy. A new version takes effect when it is posted on the Website, unless the new version provides otherwise.
12.2. Matters not governed by this Policy are resolved in accordance with the legislation of the Russian Federation.
